@socketsecurity/cli-with-sentry 1.1.133 → 1.1.134

package/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.134](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.134) - 2026-07-01
+
+### Fixed
+- `--reach-use-only-pregenerated-sboms` now recognizes Socket facts files (`.socket.facts.json`) as pre-generated SBOMs, alongside CycloneDX and SPDX — matching what the reachability analyzer accepts. Previously a project whose only pre-generated SBOM was a `.socket.facts.json` was ignored by this flag.
+
 ## [1.1.133](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.133) - 2026-07-01
 
 ### Changed

package/dist/cli.js

@@ -6244,11 +6244,14 @@ async function generateAutoManifest({
   };
 }
 
-// Keys for CDX and SPDX in the supported files response.
-const CDX_SPDX_KEYS = ['cdx', 'spdx'];
-function getCdxSpdxPatterns(supportedFiles) {
+// Supported-files response keys whose files count as pre-generated SBOMs:
+// CycloneDX, SPDX, and Socket facts (`.socket.facts.json`, under `socket`).
+// Kept in sync with Coana's `--use-only-pregenerated-sboms` selection
+// (extractPregeneratedSbomPatterns), which matches the same three keys.
+const PREGENERATED_SBOM_KEYS = ['cdx', 'socket', 'spdx'];
+function getPregeneratedSbomPatterns(supportedFiles) {
   const patterns = [];
-  for (const key of CDX_SPDX_KEYS) {
+  for (const key of PREGENERATED_SBOM_KEYS) {
     const supported = supportedFiles[key];
     if (supported) {
       for (const entry of Object.values(supported)) {
@@ -6258,9 +6261,12 @@ function getCdxSpdxPatterns(supportedFiles) {
   }
   return patterns;
 }
-function filterToCdxSpdxOnly(filepaths, supportedFiles) {
-  const patterns = getCdxSpdxPatterns(supportedFiles);
+function filterToPregeneratedSboms(filepaths, supportedFiles) {
+  const patterns = getPregeneratedSbomPatterns(supportedFiles);
+  // `dot: true` lets `*`-prefixed patterns match leading-dot filenames such as
+  // `.socket.facts.json` (advertised as `*.socket.facts.json`).
   return filepaths.filter(filepath => vendor.micromatchExports.some(filepath, patterns, {
+    dot: true,
     nocase: true
   }));
 }
@@ -6420,13 +6426,17 @@ async function handleCreateNewScan({
     logger.logger.success('Reachability analysis completed successfully');
     reachabilityReport = reachResult.data?.reachabilityReport;
 
-    // Ensure the .socket.facts.json isn't duplicated in case it happened
-    // to be in the scan folder before the analysis was run.
-    const filteredPackagePaths = packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
-
-    // When using pregenerated SBOMs only, filter to CDX/SPDX files.
-    const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToCdxSpdxOnly(filteredPackagePaths, supportedFiles) : filteredPackagePaths;
-    scanPaths = [...pathsForScan, ...(reachabilityReport ? [reachabilityReport] : [])];
+    // When using only pre-generated SBOMs, build the scan from those inputs —
+    // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
+    // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
+    // stray `.socket.facts.json`; coana's fresh reachability report (appended
+    // below) is the authoritative facts file for the scan.
+    const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+
+    // Append coana's reachability report, but not twice: a pre-generated facts
+    // input can resolve to the same path coana wrote its report to.
+    const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
+    scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
     tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
   }
 
@@ -21830,5 +21840,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=124ab184-9379-4139-921b-7d32dd1456f3
+//# debugId=d8a70f18-1fe0-4a46-92e4-b0faf786bd57
 //# sourceMappingURL=cli.js.map